Budibase CVE-2026-72853

Exploitation requires the simultaneous presence of three specific conditions: (1) the attacker must hold Budibase write-level permissions (PR:H) on a table connected to an Oracle datasource - standard viewer or read-only roles are insufficient; (2) the targeted table's name must contain a double-quote character, which is syntactically valid in Oracle but atypical in standard naming conventions; and (3) the Budibase instance must be configured with an active Oracle datasource connector. The vulnerability is triggered by the post-write row lookup operation, meaning a write action to the target table must occur to reach the vulnerable code path. Limiting factors include the PR:H barrier (rules out external unauthenticated attackers), the AC:H table-naming precondition (rules out default or conventionally named tables), and the requirement for an Oracle backend specifically (rules out MySQL, PostgreSQL, and other connector types). These conditions collectively mean that only a subset of privileged Budibase users in Oracle-connected deployments with non-standard table names are positioned to exploit this flaw.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:P) captures both the severity ceiling and the practical exploitation barriers. High privilege requirements (PR:H) mean an attacker must already hold write-level access within the Budibase application, not merely network access. High attack complexity (AC:H) and the presence of preconditions (AT:P) reflect that the targeted Oracle table must contain a double-quote in its name - an uncommon but not impossible naming convention in legacy or multi-language Oracle environments. The subsequent-system impact metrics (SC:H/SI:H/SA:H) accurately represent the risk escalation: successful injection executes as the Oracle database user, potentially granting access far beyond what Budibase's application-layer permissions intended. No CISA KEV listing and no public exploit code have been identified, which reduces urgency compared to actively exploited flaws. For organizations running Budibase with Oracle connectors, this is a meaningful privilege-escalation-to-database risk, but not a mass-exploitation scenario. The 8.8 score is directionally correct but should not be treated as equivalent in urgency to a PR:N, AC:L flaw of the same severity.

An insider or compromised account holding Budibase write permissions identifies or provisions an Oracle-connected table whose name includes a double-quote character. By submitting a crafted write operation to that table, the attacker causes the Oracle connector to construct a malformed post-write lookup query in which the unescaped double-quote breaks the identifier boundary, injecting attacker-controlled SQL. The injected SQL executes under the Oracle datasource service account's credentials, enabling the attacker to query or manipulate any Oracle data accessible to that account beyond the intended Budibase application scope. No public proof-of-concept code has been identified at time of analysis.